User Tools

Site Tools


ipw2200_generic

Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revisionPrevious revision
Next revision
Previous revision
Next revisionBoth sides next revision
ipw2200_generic [2007/08/29 18:47] – weird character + hint when fails drioipw2200_generic [2007/08/29 19:01] – ptw attack drio
Line 154: Line 154:
  
 If the attack fails, try to rerun the command again ommiting the "-h <AP MAC>" parameter. If the attack fails, try to rerun the command again ommiting the "-h <AP MAC>" parameter.
 +
 +
 +
 +
 +
  
  
Line 162: Line 167:
  
 Now we will create an arp-request packet using the aquired keysteam file. The "-l" and "-k" options are the source IP and destination IP.  Now we will create an arp-request packet using the aquired keysteam file. The "-l" and "-k" options are the source IP and destination IP. 
-They can be any valid IP. The destination can be the gateway (router IP) but the attack run faster if it is an arbitrary IP. This can be run  +If you use valid destination IPs then you will be running an [[arp_amplification|amplification attack]]. This can be run in the same window  
-in the same window we run the chopchop attack:+we run the chopchop attack:
        
-       # packetforge-ng -0 -a <AP MAC> -h 00:11:22:33:44:55 -k 192.168.1.100 -l 192.168.1.101 -y replay_dec-####.xor -w arp-request+     # packetforge-ng -0 -a <AP MAC> -h 00:11:22:33:44:55 -k 192.168.1.100 -l 192.168.1.101 -y replay_dec-####.xor -w arp-request
  
  
Line 176: Line 181:
  
       # aireplay-ng -2 -r arp-request eth1       # aireplay-ng -2 -r arp-request eth1
 +
  
  
Line 188: Line 194:
 We have to wait now so airodump-ng gathers enough data (enough IVs) so we can run airocrack-ng.  We have to wait now so airodump-ng gathers enough data (enough IVs) so we can run airocrack-ng. 
 How many packages we need so airocrack-ng cracks the wep key? It depends. The version of  How many packages we need so airocrack-ng cracks the wep key? It depends. The version of 
-airocrack-ng that comes with backtrack2 is not the lastest one. There have been a lot of improvements in recent versions  +airocrack-ng that comes with backtrack2 is not the lastest one so we need around 1.000.000 of IVs. 
-that have reduced the number of IVs neededIn my experience, I have found 300k (data output) is more than enough. +If we are using the latest version (0.9 and up100.000 is enough.
- +
- +
- +
- +
  
  
Line 201: Line 202:
 In another window we launch: In another window we launch:
  
-      # aircrack-ng dump*.cap+      # aircrack-ng -z dump*.cap
  
 Depending the number of packages you have gathered, this may take some minutes or you may get the key inmediately. Depending the number of packages you have gathered, this may take some minutes or you may get the key inmediately.
 +The -z argument tells aircrack-nt to try a ptw attack also. If you version of aircrack-ng doesn't support it, just
 +ommit it.
  
 === NOTE: === === NOTE: ===
ipw2200_generic.txt · Last modified: 2009/09/26 14:27 by darkaudax