Ok. First off, cracking someone else’s WEP key and gaining access to their Network is illegal.
Doing so, may result in you getting an enforced reach-around by a man much bigger than you. Remember, you are sat at a PC, whilst he is out shanking grannies or robbing banks.
You can however have lot’s of ‘fun’ as I have, setting your own (or a spare) router to WEP and turning this theory into practical experience
———————-
I’m no expert, but here is the theory from what I have picked up.
An ARP packet is basically your router or PC saying “Who is on IP 192.168.0.3?”, the response would be “I am, and my MAC is 00:00:00:00:00″. So because an ARP packet has a defined size, everything in addition to that can be considered the enclosing WEP encryption, so by collecting enough of these ARP packets and running a comparison, you should be able to find the static data across all of the packets, which will be the WEP key.
Anyone who has sat watching a packet analyser like WinPcap, will know that ARP packets are not that common, maybe 1 every few minutes. To crack a 56bit WEP key you need about 30,000; for a 128bit key you’ll need 60,000+. So we need to trick the router into sending an excessive amount of ARP packets.
ARP INJECTION
Now I may be wrong, but from my testing I believe the following to be true “If the AP has no clients connected there will be no ARP packets being sent”, hence any attempt to increase this flow will fail, anything multiplied by zero is zero.
There are ways to trick a router into thinking a client is connected (see Frag and Chop Chop attack to follow), but I am less aware of how these two techniques work at present. If however there is a connected client then you can continue.
Before we begin, I’ll give some background regards my own setup which may help the following make more sense.
- My mac [-h] is 00:22:69:35:6D:C5,
- My routers BSSID (mac) [-a & -b] is 00:0F:B5:BF:C2:8C,
- It is on channel [-c] 6,
- It’s ESSID [-e] is Hackyou.
- Your wireless lan card’s identifier, mine is wlan0
- I am using BT4 pre on my Acer Aspire One. (Your wireless card must support injection, you should check this on the madwifi site, before you waste your time)
The science bit
You want to open a konsole window and be on root (sudo) for all of the below steps.
Airodump-ng wlan0
Screenshot of
Grab the ESSID, BSSID & Channel details, you will need all of this to complete the crack. (You can Ctrl+C to stop it at this point, allows copy and paste to work) You want one with an associated client (bottom detail) for this attack to work.
Airodump-ng –w wep –c [channel] –bssid [bssid] wlan0 (There are two – before bssid)
Screenshot of
Locks onto AP for ARP data collection and begins saving it to the defined -w file-name.
New konsole Aireplay-ng -1 0 –a [bssid] –h [mac] wlan0
Screenshot of
This associates your mac address with the AP, allowing you to ‘communicate’ with it.
New konsole Aireplay-ng -3 –b [bssid] wlan0
Screenshot of
Starts collecting ARP packets – Wait for 30,000 for 64bit key or 60,000 for 128bit (Below screen shot of airodump at work. We care about the #data value at the top, currently at 12152)
aireplay-ng -3 -b wlan0
New konsole Dir
Screenshot of
Copy the wep*.cap file name, you’ll need this (the data airmon-ng has collected) to crack the WEP key. Mine was full of previous attempts, suggest you either delete after each attack or give a unique -w file-name.
Aircrack-ng [wep*.cap]
Screenshot of the
This will keep trying if the collected data is not enough, but the end result should be “Key Found” et voila!
Tags: aircrack-ng, aireplay-ng, airmon-ng, ARP Injection, BT4, WEP cracking
