Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Crack WPA/WPA2 Wi-Fi Routers with Aircrack-Ng and Hashcat

github.com

Post reply on HN
Print view View original

121–130 of 140 posts

Re: Crack WPA/WPA2 Wi-Fi Routers with Aircrack-Ng and Hashcat

#121

Post by icebraining »

poizan42 wrote: post #119
icebraining wrote: post #112

Earlier quoted context omitted.

You just reply to any DNS request with your own server's IP, which accepts any HTTP requests with a redirection to the captive portal. The replies can have low TTLs to avoid the caching problem.

The common web browsers caches DNS responses irrespective of their TTL values, which may be for as long as 30 minutes[0]. [0]: http://www.zytrax.com/books/dns/info/minimum-ttl.html

Firefox and Chrome only store for 60s and 30s, respectively.

For IE, you can just refuse connections to the internal webserver for logged in users, as IE will then mark those IPs as bad and refresh the DNS: https://blogs.msdn.microsoft.com/ieinternals/2012/09/26/brai...

Re: Crack WPA/WPA2 Wi-Fi Routers with Aircrack-Ng and Hashcat

#122

Post by slackingoff2017 »

amenghra wrote: post #106
zeta0134 wrote: post #84

Earlier quoted context omitted.

This is a reasonable guess at how encryption works, but it's also flawed. The key you need to crack on a Wireless Router isn't the key that's used for actual encryption of data, but rather the key used to set up that encryption in the first place. Basically, your keys are used to handshake with the access point, and then exchange a new set of temporary keys for the duration of your connection. These temporary keys (w…

The difference between an access point and HTTPS on a web server is that the access point doesn't have an identity to tie the key exchange. You can sprinkle DH here and there to incrementally improve things but it's not going to be bullet proof against active man-in-the-middle attacks. With things like Lets Encrypt, having each access point own a short lived certificate becomes possible and you can then bootstrap a s…

You can have bulletproof protection against MITM as long as you have a shared secret so it's possible with wifi. The other answers in this chain about PAKE have details.

Re: Crack WPA/WPA2 Wi-Fi Routers with Aircrack-Ng and Hashcat

#123

Post by slackingoff2017 »

mdeeks wrote: post #19
throwasehasdwi wrote: post #15

I'm not sure why this is amazing enough to make the first page but W/E it's HN :). Just so less informed are aware, this has been feasible for maybe 7 years (since GPU calculation became possible). Just so nobody freaks out, this is cracking weak passwords, not broken WPA. I have myself cracked countless WiFi passwords when security testing. It's easy if the passwords are bad, which is maybe 90% of the time for home…

Can someone define what is considered a weak vs strong password now for WiFi? The only guides I found online are years old. Is 10 characters considered weak for mixed case letters, numbers, plus punctuation now?

I read in many places that the easiest way to generate a really strong password is to memorize a fairly long sentence and use the first letter of each word.

However definitely DONT use a quote or lyrics. Needs to be something unique.

Re: Crack WPA/WPA2 Wi-Fi Routers with Aircrack-Ng and Hashcat

#124

Post by slackingoff2017 »

webaholic wrote: post #39

To the script kiddies out there who read this: Do not try this on others wifi. It is a crime in the USA to crack network routers. Although the chance of you getting caught is low, better be safe than sorry.

It is possible to catch 4 way handshakes completely passively. You're not hacking into anything, simply observing.

It's not illegal to receive signals on an unlicensed band with stock equipment

Re: Crack WPA/WPA2 Wi-Fi Routers with Aircrack-Ng and Hashcat

#125

Post by danieka »

rxhernandez wrote: post #46
aerovistae wrote: post #8

I attempted to do this once and it turned out to be monumentally difficult. I got as far as setting up a bootable kali thumb drive before getting stopped in my tracks by hardware incompatibilities and unexpected behaviors and errors. These articles make it sounds a LOT easier than it is. I was very disappointed because I was really excited about it.

I beg to differ. I was doing this at 15 or 16 years old in 2006 when it was still called backtrack. So long as you had a mainstream laptop, the most difficult part was buying a compatible wireless card. To note, the extent of my technical abilities at that time wasn't much beyond being able to install a mainstream linux distribution or write a simple program in C.

Thanks for the nostalgia trip. We must be about the same age and I remember hitting up local corporations that had WEP encrypted networks and offering them my help in improving their security.

Felt like a real security expert then ;) I'm out of that loop now but security sure did seem a lot easier to get a grip on at that time.

Re: Crack WPA/WPA2 Wi-Fi Routers with Aircrack-Ng and Hashcat

#126

Post by jagermo »

throwasehasdwi wrote: post #15

I'm not sure why this is amazing enough to make the first page but W/E it's HN :). Just so less informed are aware, this has been feasible for maybe 7 years (since GPU calculation became possible). Just so nobody freaks out, this is cracking weak passwords, not broken WPA. I have myself cracked countless WiFi passwords when security testing. It's easy if the passwords are bad, which is maybe 90% of the time for home…

If I might ask, how would you compile a password list for a non-english speaking country?

Just look for a wordlist in the respective language or also try to create your own via tools like CeWL?

Re: Crack WPA/WPA2 Wi-Fi Routers with Aircrack-Ng and Hashcat

#129

Post by omginternets »

slackingoff2017 wrote: post #124
webaholic wrote: post #39

To the script kiddies out there who read this: Do not try this on others wifi. It is a crime in the USA to crack network routers. Although the chance of you getting caught is low, better be safe than sorry.

It is possible to catch 4 way handshakes completely passively. You're not hacking into anything, simply observing. It's not illegal to receive signals on an unlicensed band with stock equipment

>You're not hacking into anything, simply observing.

Technical distinctions don't always map onto legal distinctions. Even if you're eventually acquitted, how much do you want to pay yourself per hours to explain this to a judge?

Re: Crack WPA/WPA2 Wi-Fi Routers with Aircrack-Ng and Hashcat

#130

Post by xori »

xori wrote: post #52
throwasehasdwi wrote: post #50

Earlier quoted context omitted.

You can't brute force a nonce offline when you don't know if you answer is right unless you ask the AP. Different protocols than sending hashes where you can tell if your hash is correct just by looking at it. You are right that the AP couldn't block you without blocking everyone, but since you need to check your answer with the AP for each guess your attack becomes extremely visible. I guess you could still DDOS the…

But you can capture the first encrypted packet from the router, and you know what the protocol is to test if your decoded version is correct. I still don't see how this helps.

To clarify, I agree that the individual connection key is safe from brute force. But I feel like the initial shared key is vulnerable. I doubt you'd get MITM on your connection, but you can still get a bad actor on your network.

I feel like the initial key exchange should be done with something most resource intensive than elliptic curves.

Post reply on HN