newbie_guide
Differences
This shows you the differences between two versions of the page.
Both sides previous revisionPrevious revisionNext revision | Previous revisionNext revisionBoth sides next revision | ||
newbie_guide [2010/11/21 00:05] – typos sleek | newbie_guide [2018/11/21 23:29] – [The lazy way] Update interface name + small updates mister_x | ||
---|---|---|---|
Line 2: | Line 2: | ||
Idea and initial work: ASPj\\ | Idea and initial work: ASPj\\ | ||
Additions by: a number of good souls\\ | Additions by: a number of good souls\\ | ||
- | Last updated: | + | Last updated: |
\\ | \\ | ||
- | This tutorial will give you the basics to get started using the aircrack-ng suite. | + | This tutorial will give you the basics to get started using the aircrack-ng suite. |
Although it does not cover all the steps from start to finish like this tutorial, the [[simple_wep_crack|Simple WEP Crack]] tutorial covers the actual aircrack-ng steps in much more detail. | Although it does not cover all the steps from start to finish like this tutorial, the [[simple_wep_crack|Simple WEP Crack]] tutorial covers the actual aircrack-ng steps in much more detail. | ||
Line 17: | Line 17: | ||
To determine to which category your card belongs to, see [[compatibility_drivers|hardware compatibility page]]. Read [[compatible_cards|Tutorial: | To determine to which category your card belongs to, see [[compatibility_drivers|hardware compatibility page]]. Read [[compatible_cards|Tutorial: | ||
- | First, you need to know which chipset is used in your wireless card and which driver you need for it. You will have determined this using the information in the previous paragraph. | + | First, you need to know which chipset is used in your wireless card and which driver you need for it. You will have determined this using the information in the previous paragraph. |
- | As I own a Ralink USB device, I am providing the steps to get it working with Aircrack-ng. | ||
- | |||
- | If you own another type of card, check the [[install_drivers|installing drivers page]] for instructions about other drivers. | ||
- | |||
- | |||
- | ===== RaLink USB rt2570 Setup guide ===== | ||
- | |||
- | If you own a rt2570 USB device (like D-Link DWL-G122 rev. B1 or Linksys WUSB54G v4) you should use the drivers from http:// | ||
- | |||
- | Lets unpack, compile and install the drivers: | ||
- | |||
- | tar xfj rt2570-k2wrlz-1.3.0.tar.bz2 | ||
- | cd rt2570-k2wrlz-1.3.0/ | ||
- | make | ||
- | make install | ||
- | |||
- | The last step has to be performed as root. Use su to change to root. | ||
- | Now we can load the module into the kernel: | ||
- | modprobe rt2570 | ||
- | |||
- | Plug in your card, it should be recognized as rausb0 now. Run iwconfig to list your wireless devices and check if everything is working. | ||
===== Aircrack-ng installation ===== | ===== Aircrack-ng installation ===== | ||
- | ==== Source ==== | + | Get the latest copy of aircrack-ng from the [[main|homepage]], use our packages |
- | + | ||
- | Get the latest copy of aircrack-ng from the homepage: http:// | + | |
- | The following commands would have to be changed if you use a newer version of the software. | + | |
- | + | ||
- | Unpacking, compiling, installing: | + | |
- | + | ||
- | tar xfz aircrack-ng-1.0-rc1.tar.gz | + | |
- | cd aircrack-ng-1.0-rc1 | + | |
- | make | + | |
- | make install | + | |
- | + | ||
- | As usual, the last step needs to be performed as root, use **su** | + | |
- | + | ||
- | ==== YUM ==== | + | |
- | + | ||
- | **WARNING!!!** Currently, neither of the repositories hosts the latest version of Aircrack-ng. It's recommended that you use the first method instead. | + | |
- | + | ||
- | If you are using a system like Redhat | + | |
- | + | ||
- | su | + | |
- | yum -y install aircrack-ng | + | |
- | + | ||
- | ==== RPM ==== | + | |
- | + | ||
- | **WARNING!!!** Currently, neither of the repositories hosts the latest version of Aircrack-ng. It's recommended that you use the first method instead. | + | |
- | + | ||
- | If you are using a system which is rpm-based then you can take the easy way to install aircrack-ng. (Example for Redhat Linux 4) | + | |
- | + | ||
- | su | + | |
- | rpm -ihv http:// | + | |
- | IMPORTANT: Check http:// | + | To install |
====== IEEE 802.11 basics ====== | ====== IEEE 802.11 basics ====== | ||
Line 117: | Line 66: | ||
===== Discovering Networks ===== | ===== Discovering Networks ===== | ||
- | The first thing to do is looking out for a potential target. The aircrack-ng suite contains [[airodump-ng]] for this - but other programs like | + | The first thing to do is looking out for a potential target. The aircrack-ng suite contains [[airodump-ng]] for this - but other programs like [[https:// |
- | [[http://www.kismetwireless.net/ | + | |
- | Prior to looking for networks, you must put your wireless card into what is called " | + | Prior to looking for networks, you must put your wireless card into what is called " |
- | To put your wireless card into monitor mode: | + | To put your wireless card into monitor mode using [[airmon-ng]]: |
- | [[airmon-ng]] start rausb0 | + | |
- | To confirm it is in monitor mode, run " | + | It will create create another interface, and append " |
- | Then, start airodump-ng to look out for networks: | + | Then, start [[airodump-ng]] to look out for networks: |
- | airodump-ng | + | airodump-ng |
- | " | ||
- | Take a look in the documentation of the nic driver. For most newer drivers, the primary interface name is " | ||
If airodump-ng could connect to the WLAN device, you'll see a screen like this: | If airodump-ng could connect to the WLAN device, you'll see a screen like this: | ||
- | {{http:// | + | {{https:// |
+ | |||
+ | [[airodump-ng]] hops from channel to channel and shows all access points it can receive beacons from. Channels 1 to 14 are used for 802.11b and g (in US, they only are allowed to use 1 to 11; 1 to 13 in Europe with some special cases; 1-14 in Japan). 802.11a is in the 5GHz and availability in different countries is more fragmented than on 2.4GHz. In general, known channels starts at 36 (32 in some countries) to 64 (68 in some countries) and 96 to 165. Wikipedia has more details on channel availability. The Linux [[https:// | ||
- | [[airodump-ng]] hops from channel to channel and shows all access points it can receive beacons from. Channels 1 to 14 are used for 802.11b and g (in US, they only are allowed to use 1 to 11; 1 to 13 in Europe with some special cases; 1-14 in Japan). Channels between 36 and 149 are used for 802.11a. | + | The current channel is shown in the top left corner. |
After a short time some APs and (hopefully) some associated clients will show up. | After a short time some APs and (hopefully) some associated clients will show up. | ||
Line 146: | Line 94: | ||
^ BSSID | The MAC address of the AP | | ^ BSSID | The MAC address of the AP | | ||
+ | ^ RXQ | Quality of the signal, when locked on a channel | | ||
^ PWR | Signal strength. Some drivers don't report it | | ^ PWR | Signal strength. Some drivers don't report it | | ||
^ Beacons | ^ Beacons | ||
Line 162: | Line 111: | ||
^ Probes | ^ Probes | ||
- | Now you should look out for a target network. It should have a client connected because cracking networks without a client is an advanced topic (See [[how_to_crack_wep_with_no_clients|How to crack wep with no clients]]). It should use WEP encryption and have a high signal strength. Maybe you can re-position your antenna to get a better signal. Often a few centimeters make a big difference in signal strength. | + | Now you should look out for a target network. It should have a client connected because cracking networks without a client is an advanced topic (See [[how_to_crack_wep_with_no_clients|How to crack WEP with no clients]]). It should use WEP encryption and have a high signal strength. Maybe you can re-position your antenna to get a better signal. Often a few centimeters make a big difference in signal strength. |
In the example above the net 00: | In the example above the net 00: | ||
Line 170: | Line 119: | ||
Because of the channel hopping you won't capture all packets from your target net. So we want to listen just on one channel and additionally write all data to disk to be able to use it for cracking: | Because of the channel hopping you won't capture all packets from your target net. So we want to listen just on one channel and additionally write all data to disk to be able to use it for cracking: | ||
- | airodump-ng -c 11 --bssid 00: | + | airodump-ng -c 11 --bssid 00: |
With the -c parameter you tune to a channel and the parameter after -w is the prefix to the network dumps written to disk. The " | With the -c parameter you tune to a channel and the parameter after -w is the prefix to the network dumps written to disk. The " | ||
Line 190: | Line 139: | ||
The number of IVs you need to crack a key is not fixed. This is because some IVs are weaker and leak more information about the key than others. Usually these weak IVs are randomly mixed in between the stronger ones. So if you are lucky, you can crack a key with only 20 000 IVs. But often this it not enough and aircrack-ng will run a long time (up to a week or even longer with a high fudge factor) and then tell you the key could not be cracked. If you have more IVs cracking can be done a lot faster and is usually done in a few minutes, or even seconds. Experience shows that 40 000 to 85 000 IVs is usually enough for cracking. | The number of IVs you need to crack a key is not fixed. This is because some IVs are weaker and leak more information about the key than others. Usually these weak IVs are randomly mixed in between the stronger ones. So if you are lucky, you can crack a key with only 20 000 IVs. But often this it not enough and aircrack-ng will run a long time (up to a week or even longer with a high fudge factor) and then tell you the key could not be cracked. If you have more IVs cracking can be done a lot faster and is usually done in a few minutes, or even seconds. Experience shows that 40 000 to 85 000 IVs is usually enough for cracking. | ||
- | There are some more advanced APs out there that use an algorithm to filter out weak IVs. The result is either that you can't get more than " | + | There are some more advanced APs out there that use an algorithm to filter out weak IVs. The result is either that you can't get more than " |
====== Active attacks ====== | ====== Active attacks ====== | ||
===== Injection support ===== | ===== Injection support ===== | ||
- | Most devices don't support injection - at least not without patched drivers. Some only support certain attacks. Take a look at the [[compatibility_drivers|compatibility page]], column aireplay. | + | Most devices don't support injection - at least not without patched drivers. Some only support certain attacks. Take a look at the [[compatibility_drivers|compatibility page]], column aireplay. |
The first step is to make sure packet injection really works with your card and driver. The easiest way to test it is the [[injection_test|injection test]] attack. | The first step is to make sure packet injection really works with your card and driver. The easiest way to test it is the [[injection_test|injection test]] attack. | ||
Line 202: | Line 151: | ||
Try to connect to your AP using [[aireplay-ng]]: | Try to connect to your AP using [[aireplay-ng]]: | ||
- | aireplay-ng --fakeauth 0 -e "your network ESSID" -a 00: | + | aireplay-ng --fakeauth 0 -e "your network ESSID" -a 00: |
The value after -a is the BSSID of your AP. | The value after -a is the BSSID of your AP. | ||
Line 226: | Line 175: | ||
==== The idea ==== | ==== The idea ==== | ||
- | [[http:// | + | [[https:// |
sends back an answer. Because WEP does not protect against replay, you can sniff a packet, send it out again and again and it is still valid. | sends back an answer. Because WEP does not protect against replay, you can sniff a packet, send it out again and again and it is still valid. | ||
So you just have to capture and replay an ARP-request targeted at the AP to create lots of traffic (and sniff IVs). | So you just have to capture and replay an ARP-request targeted at the AP to create lots of traffic (and sniff IVs). | ||
Line 236: | Line 185: | ||
Wait for a client to show up on the target network. Then start the attack: | Wait for a client to show up on the target network. Then start the attack: | ||
- | aireplay-ng --arpreplay -b 00: | + | aireplay-ng --arpreplay -b 00: |
-b specifies the target BSSID, -h the MAC of the connected client. | -b specifies the target BSSID, -h the MAC of the connected client. | ||
Line 251: | Line 200: | ||
the -r < | the -r < | ||
- | When using the arp injection technique, you can use the PTW method to crack the WEP key. This dramatically reduces the number of data packets you need and also the time needed. | + | When using the ARP injection technique, you can use the PTW method to crack the WEP key. This dramatically reduces the number of data packets you need and also the time needed. |
If the number of data packets received by airodump-ng sometimes stops increasing you maybe have to reduce the replay-rate. You do this with the -x <packets per second> option. I usually start out with 50 and reduce until packets are received continuously again. Better positioning of your antenna usually also helps. | If the number of data packets received by airodump-ng sometimes stops increasing you maybe have to reduce the replay-rate. You do this with the -x <packets per second> option. I usually start out with 50 and reduce until packets are received continuously again. Better positioning of your antenna usually also helps. | ||
Line 273: | Line 222: | ||
====== Further tools and information ====== | ====== Further tools and information ====== | ||
- | [[http:// | + | [[https:// |
newbie_guide.txt · Last modified: 2018/11/21 23:31 by mister_x