Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Crack WPA/WPA2 Wi-Fi Routers with Aircrack-Ng and Hashcat

github.com

Post reply on HN
Print view View original

51–60 of 140 posts

Re: Crack WPA/WPA2 Wi-Fi Routers with Aircrack-Ng and Hashcat

#51

Post by [deleted] »

xori wrote: post #45
throwasehasdwi wrote: post #36

Earlier quoted context omitted.

It doesn't give you a hash to crack. It reduces your speed of guessing passwords from "how quick can you hash X", which is millions of times per second, to "how many times can I attempt to get in before the access point blocks me". This major issue with WPA password cracking today is that it can be done "offline". You can pull the handshake out of the air and bang on it as long as you want. It's pretty much the same…

I'm not sure how PAKE works, but how would an AP block you? MAC address are forgeable. And any nonce an AP sends down as a one-time salt would be visible to you and you could still just brute force it offline. EDIT: After reading up on SPAKE2, it's basically just a Diffe-Hellman exchange. You can still totally do a brute force because you know what the first encrypted payload should look like and you can listen in fo…

[deleted]

Re: Crack WPA/WPA2 Wi-Fi Routers with Aircrack-Ng and Hashcat

#52

Post by xori »

throwasehasdwi wrote: post #50
xori wrote: post #45

Earlier quoted context omitted.

I'm not sure how PAKE works, but how would an AP block you? MAC address are forgeable. And any nonce an AP sends down as a one-time salt would be visible to you and you could still just brute force it offline. EDIT: After reading up on SPAKE2, it's basically just a Diffe-Hellman exchange. You can still totally do a brute force because you know what the first encrypted payload should look like and you can listen in fo…

You can't brute force a nonce offline when you don't know if you answer is right unless you ask the AP. Different protocols than sending hashes where you can tell if your hash is correct just by looking at it. You are right that the AP couldn't block you without blocking everyone, but since you need to check your answer with the AP for each guess your attack becomes extremely visible. I guess you could still DDOS the…

But you can capture the first encrypted packet from the router, and you know what the protocol is to test if your decoded version is correct. I still don't see how this helps.

Re: Crack WPA/WPA2 Wi-Fi Routers with Aircrack-Ng and Hashcat

#53

Post by proctor »

wil421 wrote: post #14
The_Sponge wrote: post #10

Earlier quoted context omitted.

It's not for the faint of heart or faint of technical skill - different drivers have different behaviors and ways to enter the various capture and raw packet modes needed to do this. Personally, as long as I stick to supported chipsets, I've almost never had an issue.

Have you found a wifi card that will work on any laptop or desktop?

I tested some of the most popular Kali Linux compatible cards against each other here[0]. Note that there is a version 2 of the popular and cheap TP-Link TL-WN722N which DOES NOT work like the version 1 and should be avoided.

All of these cards are "known to just work" on linux at least.

[0] http://rooftopbazaar.com/wirelesscards/

Re: Crack WPA/WPA2 Wi-Fi Routers with Aircrack-Ng and Hashcat

#54

Post by pletnes »

bobsgame wrote: post #47

I had the idea a long time ago to make a dd-wrt image which would automatically crack the vulnerable routers within distance, detect the model, and install a compatible version of itself in order to spread virally and create a mesh network. I'm not going to pursue it because it probably breaks a lot of laws, but I'm still curious if it would have been possible. Does anyone know if this is actually feasible? Maybe the…

Did you mean this?

http://gizmodo.com/264050/slurpr-wi-fi-box-sucks-up-six-sign...

Re: Crack WPA/WPA2 Wi-Fi Routers with Aircrack-Ng and Hashcat

#55

Post by crummy »

bobsgame wrote: post #47

I had the idea a long time ago to make a dd-wrt image which would automatically crack the vulnerable routers within distance, detect the model, and install a compatible version of itself in order to spread virally and create a mesh network. I'm not going to pursue it because it probably breaks a lot of laws, but I'm still curious if it would have been possible. Does anyone know if this is actually feasible? Maybe the…

Probably cracking passwords would be very slow on router hardware - cool idea though.

Re: Crack WPA/WPA2 Wi-Fi Routers with Aircrack-Ng and Hashcat

#56

Post by throwasehasdwi »

xori wrote: post #52
throwasehasdwi wrote: post #50

Earlier quoted context omitted.

You can't brute force a nonce offline when you don't know if you answer is right unless you ask the AP. Different protocols than sending hashes where you can tell if your hash is correct just by looking at it. You are right that the AP couldn't block you without blocking everyone, but since you need to check your answer with the AP for each guess your attack becomes extremely visible. I guess you could still DDOS the…

But you can capture the first encrypted packet from the router, and you know what the protocol is to test if your decoded version is correct. I still don't see how this helps.

I'm not a crypto expert and I'm sure even if I was it would be difficult to explain. Wiki page on SRP has a good description though:

Like all PAKE protocols, an eavesdropper or man in the middle cannot obtain enough information to be able to brute force guess a password without further interactions with the parties for each guess.

In layman's terms, given two parties who both know a password, SRP (or any other PAKE protocol) is a way for one party (the "client" or "user") to demonstrate to another party (the "server") that they know the password, without sending the password itself, nor any other information from which the password can be broken. Further, it is not possible to conduct an offline brute force search for the password.

https://en.wikipedia.org/wiki/Secure_Remote_Password_protoco...

Re: Crack WPA/WPA2 Wi-Fi Routers with Aircrack-Ng and Hashcat

#57

Post by throwasehasdwi »

MadSax wrote: post #43
throwasehasdwi wrote: post #36

Earlier quoted context omitted.

It doesn't give you a hash to crack. It reduces your speed of guessing passwords from "how quick can you hash X", which is millions of times per second, to "how many times can I attempt to get in before the access point blocks me". This major issue with WPA password cracking today is that it can be done "offline". You can pull the handshake out of the air and bang on it as long as you want. It's pretty much the same…

Thanks. I also hope that deauth frames are encrypted in the next version of WPA.

They are a current feature but not the baseline which means in practice implementations are buggy or non existent. I've had a few nicer routers where I could turn the options on but most clients are not able to connect :( .

I need to be in the baseline standard to get qualified or nobody will implement it.

Re: Crack WPA/WPA2 Wi-Fi Routers with Aircrack-Ng and Hashcat

#58

Post by [deleted] »

pletnes wrote: post #54
bobsgame wrote: post #47

I had the idea a long time ago to make a dd-wrt image which would automatically crack the vulnerable routers within distance, detect the model, and install a compatible version of itself in order to spread virally and create a mesh network. I'm not going to pursue it because it probably breaks a lot of laws, but I'm still curious if it would have been possible. Does anyone know if this is actually feasible? Maybe the…

Did you mean this? http://gizmodo.com/264050/slurpr-wi-fi-box-sucks-up-six-sign...

[deleted]

Re: Crack WPA/WPA2 Wi-Fi Routers with Aircrack-Ng and Hashcat

#59

Post by [deleted] »

pletnes wrote: post #54
bobsgame wrote: post #47

I had the idea a long time ago to make a dd-wrt image which would automatically crack the vulnerable routers within distance, detect the model, and install a compatible version of itself in order to spread virally and create a mesh network. I'm not going to pursue it because it probably breaks a lot of laws, but I'm still curious if it would have been possible. Does anyone know if this is actually feasible? Maybe the…

Did you mean this? http://gizmodo.com/264050/slurpr-wi-fi-box-sucks-up-six-sign...

[deleted]

Re: Crack WPA/WPA2 Wi-Fi Routers with Aircrack-Ng and Hashcat

#60

Post by goda90 »

crummy wrote: post #55
bobsgame wrote: post #47

I had the idea a long time ago to make a dd-wrt image which would automatically crack the vulnerable routers within distance, detect the model, and install a compatible version of itself in order to spread virally and create a mesh network. I'm not going to pursue it because it probably breaks a lot of laws, but I'm still curious if it would have been possible. Does anyone know if this is actually feasible? Maybe the…

Probably cracking passwords would be very slow on router hardware - cool idea though.

The load could be distributed between nodes, or the original node could be backed by a more powerful machine to do the cracking.
Post reply on HN