Earlier quoted context omitted.
It's not for the faint of heart or faint of technical skill - different drivers have different behaviors and ways to enter the various capture and raw packet modes needed to do this. Personally, as long as I stick to supported chipsets, I've almost never had an issue.
Have you found a wifi card that will work on any laptop or desktop?
Crack WPA/WPA2 Wi-Fi Routers with Aircrack-Ng and Hashcat
31–40 of 140 posts
Re: Crack WPA/WPA2 Wi-Fi Routers with Aircrack-Ng and Hashcat
#32Earlier quoted context omitted.
It's not viable for those random 12-ish digit passwords most ISPs will use.
Yeah, which is why it is sometimes weirdly safer to not change your SSID - a cracker can assume that someone who figured out how to change the broadcast name could've also changed the WiFi password... often to something much less secure.
SSID is used for password hashing, so better change it from default to avoid rainbow tables.
Re: Crack WPA/WPA2 Wi-Fi Routers with Aircrack-Ng and Hashcat
#33Earlier quoted context omitted.
> Just so nobody freaks out, this is cracking weak passwords, not broken WPA. I beg to differ. The fact that WPA is subject to a passive attack at all is a defect. It should use a PAKE, which would entirely avoid this type of attack. There are simple balanced PAKE protocols that would do the trick. DH-EKE, SPAKE2, J-PAKE, and even the venerable SRP would all work. I believe that several are old enough that no patents…
Yes, this is still a major problem with WPA. Also the fact that certain control packets aren't authenticated is nearly unforgivable. If correctly designed the only reasonable attack on wifi would be channel jamming, sadly after many years this still is not the case.
This is probably a good occasion for a call for WPA3: https://github.com/d33tah/call-for-wpa3
Re: Crack WPA/WPA2 Wi-Fi Routers with Aircrack-Ng and Hashcat
#34I'm not sure why this is amazing enough to make the first page but W/E it's HN :). Just so less informed are aware, this has been feasible for maybe 7 years (since GPU calculation became possible). Just so nobody freaks out, this is cracking weak passwords, not broken WPA. I have myself cracked countless WiFi passwords when security testing. It's easy if the passwords are bad, which is maybe 90% of the time for home…
> Just so nobody freaks out, this is cracking weak passwords, not broken WPA. I beg to differ. The fact that WPA is subject to a passive attack at all is a defect. It should use a PAKE, which would entirely avoid this type of attack. There are simple balanced PAKE protocols that would do the trick. DH-EKE, SPAKE2, J-PAKE, and even the venerable SRP would all work. I believe that several are old enough that no patents…
For those that don't know, like me, how would PAKE etc protect cracking of weak passwords used during client authentication?
Re: Crack WPA/WPA2 Wi-Fi Routers with Aircrack-Ng and Hashcat
#354,733,979 out of the 14,344,391 passwords (33%) in the rockyou.txt dictionary file used for cracking in this guide are too short to be WPA2 passwords, which have a minimum length of 8 characters. Are aircrack and/or hashcat smart enough to not bother hashing those short passwords?
5 million hashes only take a few seconds for wpa2 anyway... Less than two for this system: https://gist.github.com/epixoip/a83d38f412b4737e99bbef804a27...
They don't touch it in this tutorial but typically you don't check just whats in your dictionary. You also use a set of rules to manipulate your dictionary that massively increases the number of hashes to perform. Those 5 million entries quickly passes tens of billions hashes that need to be run. These initial entries might be too short like OP pointed out, but after the rules are applied it might generate many entries that will be long enough to spend time hashing.
The keyspace for WPA is huge and the hash speed is still relatively slow, even with an extremely high end system like you linked to the quality of the initial dictionary is really important.
Re: Crack WPA/WPA2 Wi-Fi Routers with Aircrack-Ng and Hashcat
#36Earlier quoted context omitted.
> Just so nobody freaks out, this is cracking weak passwords, not broken WPA. I beg to differ. The fact that WPA is subject to a passive attack at all is a defect. It should use a PAKE, which would entirely avoid this type of attack. There are simple balanced PAKE protocols that would do the trick. DH-EKE, SPAKE2, J-PAKE, and even the venerable SRP would all work. I believe that several are old enough that no patents…
For those that don't know, like me, how would PAKE etc protect cracking of weak passwords used during client authentication?
It doesn't give you a hash to crack. It reduces your speed of guessing passwords from "how quick can you hash X", which is millions of times per second, to "how many times can I attempt to get in before the access point blocks me".
This major issue with WPA password cracking today is that it can be done "offline". You can pull the handshake out of the air and bang on it as long as you want. It's pretty much the same thing as trying to guess a password from some leaked hashes vs trying to guess a password using the gmail interface.
Re: Crack WPA/WPA2 Wi-Fi Routers with Aircrack-Ng and Hashcat
#37How long does the cracking process take? I remember WEP only taking 10 minutes using aircrack-ng in BackTrace... I imagine this takes substantially longer.
Time taken to crack WEP depended on if it was a 64 or 128 bit key
I did a study using an Atom netbook - a 64 bit key (10 digits long) took 8 mins to find, 128 (26 digits) took 30 mins
Re: Crack WPA/WPA2 Wi-Fi Routers with Aircrack-Ng and Hashcat
#38Is there anything novel in there? On a first sight it seems just like a guide done hundred times before...
Nope. This is an ancient attack.
Re: Crack WPA/WPA2 Wi-Fi Routers with Aircrack-Ng and Hashcat
#39To the script kiddies out there who read this: Do not try this on others wifi. It is a crime in the USA to crack network routers. Although the chance of you getting caught is low, better be safe than sorry.
Re: Crack WPA/WPA2 Wi-Fi Routers with Aircrack-Ng and Hashcat
#40Does this only crack single word passwords? If my password was two common dictionary words or a common word plus a single number, would this try that possibility?